From: Bill Erickson <berick@esilibrary.com>
Date: Tue, 8 Oct 2013 19:58:56 +0000 (-0400)
Subject: SIP login nonce
X-Git-Url: https://old-git.evergreen-ils.org/?a=commitdiff_plain;h=684107842eb7ee9f02d5253b8613ba221d733ff8;p=working%2FEvergreen.git

SIP login nonce

Since multiple SIP clients may use the same credentials, avoid the
same-username race condition to authentication by applying a login nonce
value.

Signed-off-by: Bill Erickson <berick@esilibrary.com>
---

diff --git a/Open-ILS/src/perlmods/lib/OpenILS/SIP.pm b/Open-ILS/src/perlmods/lib/OpenILS/SIP.pm
index 46e9290781..8098d84a9d 100644
--- a/Open-ILS/src/perlmods/lib/OpenILS/SIP.pm
+++ b/Open-ILS/src/perlmods/lib/OpenILS/SIP.pm
@@ -227,9 +227,10 @@ sub login {
     my( $self, $username, $password ) = @_;
     syslog('LOG_DEBUG', "OILS: Logging in with username $username");
 
+    my $nonce = rand($$);
     my $seed = $U->simplereq( 
         'open-ils.auth',
-        'open-ils.auth.authenticate.init', $username );
+        'open-ils.auth.authenticate.init', $username, $nonce );
 
     my $response = $U->simplereq(
         'open-ils.auth', 
@@ -238,6 +239,7 @@ sub login {
             username => $username, 
             password => md5_hex($seed . md5_hex($password)), 
             type     => 'opac',
+            nonce    => $nonce
         }
     );